Dependabot alert (Go ecosystem)
Summary
Multi-value baggage header extraction in OpenTelemetry-Go causes excessive memory allocations — a remote DoS amplification vector when baggage is extracted from incoming requests.
Triage note (out of skill auto-scope)
The triage-security skill performs autonomous import-graph + exploit-surface analysis for the pip
ecosystem only. This is a Go alert, so it is not auto-dismissed and is routed to human review.
go.opentelemetry.io/otel v1.40.0 is an indirect (transitive) dependency in go.mod; no open-acn .go source references otel/baggage directly. It is pulled by the libp2p/observability stack. The DoS requires the process to extract multi-value baggage headers from attacker-influenced inbound traffic.
open-acn is the Agent Communication Network relay (libp2p) — a long-running, network-facing process, so a
remote DoS in a reachable decode/header path is in-scope by default. Reachability through the transitive
libp2p stack was not traced (Go call-graph analysis is outside the skill's tooling).
Suggested fix
Bump the dependency past the vulnerable range and go mod tidy:
- target
1.41.0 (adjust/extend the existing replace directive in go.mod if needed).
Why this issue exists / needs-human-review
Opened by the triage-security skill (Go alerts → manual review). A maintainer should confirm whether the
libp2p stack actually exercises the vulnerable path under open-acn's configuration, then bump (recommended —
both fixes are released) or dismiss the Dependabot alert with the appropriate reason.
Dependabot alert (Go ecosystem)
go.opentelemetry.io/otel(Go module, indirect)>= 1.36.0, <= 1.40.0→ first patched:1.41.0| Manifest:go.modSummary
Multi-value
baggageheader extraction in OpenTelemetry-Go causes excessive memory allocations — a remote DoS amplification vector when baggage is extracted from incoming requests.Triage note (out of skill auto-scope)
The
triage-securityskill performs autonomous import-graph + exploit-surface analysis for the pipecosystem only. This is a Go alert, so it is not auto-dismissed and is routed to human review.
go.opentelemetry.io/otel v1.40.0is an indirect (transitive) dependency ingo.mod; no open-acn.gosource references otel/baggage directly. It is pulled by the libp2p/observability stack. The DoS requires the process to extract multi-value baggage headers from attacker-influenced inbound traffic.open-acn is the Agent Communication Network relay (libp2p) — a long-running, network-facing process, so a
remote DoS in a reachable decode/header path is in-scope by default. Reachability through the transitive
libp2p stack was not traced (Go call-graph analysis is outside the skill's tooling).
Suggested fix
Bump the dependency past the vulnerable range and
go mod tidy:1.41.0(adjust/extend the existingreplacedirective ingo.modif needed).Why this issue exists / needs-human-review
Opened by the
triage-securityskill (Go alerts → manual review). A maintainer should confirm whether thelibp2p stack actually exercises the vulnerable path under open-acn's configuration, then bump (recommended —
both fixes are released) or dismiss the Dependabot alert with the appropriate reason.